Flashpackers Privacy Policy

The data controller is Flashpackers (PVT) LTD, a limited liability company incorporated and registered under the laws of the Democratic Socialist Republic of Sri Lanka, with its registered office at Lewis Place 222, 11500 Negombo, Sri Lanka, registration number PV00310133, TIN 169060312, referred to as “Flashpackers”, “we” or “us”.

For personal data enquiries and requests to exercise your rights, please email privacy@flashpackers.pl. For enquiries about our services and website, please contact hello@flashpackers.pl. You may also write to our registered office.

Our establishment in Sri Lanka does not exclude the application of the GDPR to processing related to offering services to individuals who are in the European Union. The Polish-language website and the flashpackers.pl domain do not mean that the website operator is a company registered in Poland.

This policy covers website visitors, people using our trip-planning tool, making enquiries, arranging consultations, receiving offers, subscribing to our newsletter, making bookings, taking part in trips or being nominated as emergency contacts.

We primarily receive data from you through the website, forms, email, WhatsApp, consultations and booking documents. The lead traveller may provide information about another participant, and a participant or lead traveller may provide emergency contact details. In these cases, that person is the source of the data.

If you provide someone else's data, please tell them and share this policy with them. Flashpackers remains responsible for meeting its own information obligations. Where we obtain data indirectly, we generally provide the required information within one month. If we contact the individual or disclose their data to another recipient sooner, we provide the information at the first contact or, respectively, no later than the first disclosure. We rely on an exception only where permitted by law, for example if the individual already has the required information.

At the enquiry and trip-planning stage, we process your first and last name, email address, telephone number, preferred contact method, dates, group composition, interests, itinerary, accommodation and budget preferences, and correspondence. The scope depends on the form and what is needed to handle your enquiry.

For a booking, we may also need your date of birth, nationality, billing details, flight details, passport number and expiry date, and information about payments, the accepted offer and acceptance of documents. We do not collect passport copies or scans.

For emergency contacts, we process their first and last name, telephone number, relationship to the traveller and contact language. Health information and special requirements are subject to the additional rules in section 7. We obtain data about participants who are minors from a parent, guardian or another appropriately authorised person, only as needed to prepare and deliver the trip. We do not direct our newsletter at children or use their data for marketing.

The newsletter requires an email address; providing a first name is optional. We also retain information needed to record subscription, consent and unsubscription.

Using the website and embedded services involves sending technical data needed to communicate with servers, including an IP address. This does not automatically mean that we conduct individual behavioural analytics. Section 11 explains the website technologies.

Where the GDPR applies, we select the legal basis according to the purpose and our relationship with the individual. We do not require a single blanket consent for all aspects of organising a trip.

Enquiries, consultations and personalised offers: we use the data of the person requesting an offer to take steps at their request before entering into a contract, under Article 6(1)(b) GDPR. We handle other enquiries on the basis of our legitimate interest in conducting correspondence and answering questions, under Article 6(1)(f) GDPR.

The planning tool and access to results: we process data needed to deliver the service requested by the user or to prepare an offer under Article 6(1)(b) GDPR.

Bookings and contract performance: we process the contracting party's data under Article 6(1)(b) GDPR. We use other participants' and emergency contacts' data in our legitimate interests in organising and delivering the trip, maintaining contact and ensuring safety, under Article 6(1)(f) GDPR, taking their rights into account.

Newsletter and email marketing: we use data on the basis of freely given consent under Article 6(1)(a) GDPR and the consent to marketing communications required by applicable law. Consent is not a condition of receiving an offer or making a booking.

Security, complaints, and establishing, exercising or defending legal claims: the basis is our legitimate interest under Article 6(1)(f) GDPR. This also includes retaining necessary evidence of consent and respecting marketing opt-outs.

Accounting and payments: we use data to perform the contract and meet accounting obligations. We rely on Article 6(1)(c) GDPR where an obligation arises from applicable EU or Member State law. For obligations under Sri Lankan law, where the GDPR applies, we assess the legitimate-interest basis for proper business accounting and documenting transactions under Article 6(1)(f) GDPR.

Emergencies: protecting vital interests may provide a basis under Article 6(1)(d) GDPR and, for health data, Article 9(2)(c) GDPR, but only where the conditions of those provisions are met.

Your preferences and dates help us match travel suggestions to your needs. The planning tool's result is a starting point for a discussion with a consultant; it is not an automatic booking or a decision obliging you to purchase anything.

If you receive a link to your result, it remains valid for 30 days from generation. Your first name is the only identifying detail displayed on the results page. The page may also show travel suggestions based on your preferences, so please treat the link as confidential. Anyone who has the link may view the result.

Access expires automatically after 30 days. We do not provide a button for you to revoke the link yourself; contact us if it is disclosed or if you wish to request deletion of your data. Expiry of access does not automatically delete data relating to an ongoing enquiry or booking.

Where newsletter sign-up is available, the following rules apply. Subscribing requires confirmation of your email address through a link in an email. We do not automatically subscribe people who submit an enquiry, arrange a consultation or make a booking.

You may withdraw consent at any time using the unsubscribe link in the newsletter or by contacting us. Withdrawal does not affect the lawfulness of earlier processing. Unsubscribing stops marketing messages, but not correspondence needed to handle a separate enquiry or contract.

Subscription evidence includes your email address, sign-up date and source, the wording or version of the consent, and confirmation and unsubscription information. We do not track individual newsletter opens or clicks. We use delivery information to manage sending. We keep a minimal opt-out record separately from the active mailing list to prevent resubscription without fresh consent.

Please provide information about allergies, mobility restrictions, health or diet only as needed to prepare and deliver your trip safely. Do not send full medical records or information unrelated to the services requested. Dietary preferences may reveal health information or other specially protected information.

As a rule, we process this data on the basis of the individual's separate, explicit consent under Articles 6(1)(a) and 9(2)(a) GDPR. The consent wording specifies whether it covers preparing suggestions, delivering the trip and sharing necessary information with appropriate service providers.

Where a lead traveller supplies this information about other people, they should have those people's authorisation and provide their explicit consent in a form that allows it to be demonstrated. For a child, a person authorised to represent them acts on their behalf. Acceptance of the website terms does not replace consent to processing health data.

You may withdraw consent by emailing privacy@flashpackers.pl. This may prevent us from accommodating a particular requirement or providing a specific service that needs this information; it does not automatically mean that the entire trip cannot go ahead.

Authorised people handling enquiries and trips have access to data. We share necessary information with accommodation providers, drivers, guides, local coordinators and providers of booked services. What we share depends on the task; not every partner receives the full set of documents.

We also use providers of email, hosting, content management, document storage, communications, consultations, invoicing and automation. Our website infrastructure includes Vercel, Sanity and OVH. We handle enquiries through email, a CRM maintained in Excel spreadsheets and the communication channels we use. For available features, we use TidyCal for consultation scheduling, MailerLite for the newsletter and Vimeo for videos. Section 9 explains automation. Availability of a feature does not mean that data is sent to every listed provider.

Opening embedded content or following a link to an external service may also involve its provider processing data for its own purposes. We provide information about the provider and its privacy rules alongside the relevant feature. We do not sell customer data or share it with other companies for their own marketing.

Banks, payment providers, accountants, legal advisers and competent public authorities may also receive data where there is a basis for disclosure. Providers acting on our behalf process data within their assigned tasks; others, such as a bank or an independent service provider, may act as separate controllers.

We do not publish customer data or booking documents in the code repository. Providing data for one purpose does not mean it is shared with all the providers listed above.

Automation and AI tools help organise enquiries, move information between email and the CRM, and prepare draft documents and materials. Contact details and information about a planned trip may be processed for these purposes, to the extent needed for the task.

Automation supports the purpose for which we received the data; it is not a separate authorisation to use it without restriction. We limit the data provided to AI. If a task does not require the customer's identity, we remove identifying details. We do not use customer data to train publicly available AI models. We allow only provider settings and terms that ensure this restriction for customer-service automation. Health and passport documentation is not sent to general-purpose AI tools as part of routine automation.

Travel suggestions and materials involving an assessment of an offer or a commitment to a customer are reviewed by our team. Matching suggestions to your preferences may constitute profiling: your answers are used to identify suitable options, which you can discuss or change with a consultant. This does not automatically result in a refusal of service or a contract. We do not make decisions about you based solely on automated processing, including profiling, that produce legal effects or similarly significantly affect you.

Flashpackers is established in Sri Lanka. Handling enquiries and organising trips involves processing data in that country. Sri Lanka is not covered by a European Commission adequacy decision. Protection and available remedies may differ from those in the EEA.

Your providing data directly to us does not, in itself, constitute a transfer between a controller or processor and another recipient within the meaning of Chapter V GDPR. This does not release us from our obligations to protect the data. Disclosure to other entities, including cloud providers and local service providers, requires a separate assessment, even where both entities are in Sri Lanka.

Onward transfers subject to Chapter V GDPR may take place only on a valid basis: an adequacy decision covering the recipient or appropriate safeguards, such as applicable standard contractual clauses together with an assessment of the transfer conditions and additional protective measures where needed. We do not assume that an international provider's brand name, or another company in its group's participation in a data protection programme, is sufficient for every data flow.

Exceptions for transfers necessary to perform a particular travel contract may be used only within the limits of Article 49 GDPR. They are not a general basis for ongoing CRM, hosting, newsletter or AI operations. Newsletter consent or acceptance of the website terms is not consent to unrestricted transfers outside the EEA.

You can obtain information about recipients, processing countries and the bases and safeguards applicable to your data, including a copy of the safeguards used, by emailing privacy@flashpackers.pl. To protect others' rights and trade secrets, we may redact parts of documents, but we provide information that enables you to understand the protection applied.

Displaying the website, playing videos and arranging consultations requires communication with the relevant services' servers. Vimeo and TidyCal embeds may receive technical data about your device and connection. Similar principles apply to embedded social media content.

Cookies and similar technologies may support features, security or a provider's additional purposes. The absence of a separate website analytics tool does not automatically mean that no such technologies are used.

We activate non-essential technologies requiring consent only after obtaining it. Consent can be withdrawn as easily as it was given through the privacy settings provided for the relevant feature. Refusing consent does not block access to the website's basic content, although it may prevent use of an embed. Browser settings let you restrict storage on your device; they do not replace Flashpackers' obligations concerning consent.

We do not conduct our own website traffic analytics or advertising tracking of website users. Introducing such tools would require prior information to users and consent where required. Reading this policy does not constitute consent to tracking. Before activating a technology requiring consent, we explain its purpose, provider and duration.

Videos may autoplay without sound where permitted by privacy settings and the browser. You can stop playback. If an embed is unavailable, you may contact us by email about a consultation or the information it contains.

Enquiries that do not result in a booking, and associated data in email and the CRM: generally up to 12 months after the last substantive contact. An automated message does not restart this period.

A standalone planning result without a subsequent enquiry or booking: up to 90 days from creation, after which it is deleted or irreversibly anonymised. The access link expires earlier, after 30 days. Once a result is linked to an enquiry or booking, the retention period for that process applies.

Operational trip data, including health, passport and emergency contact data: generally up to 3 months after the trip ends or a cancelled booking is closed. We separate out information still needed for a specific complaint, incident, dispute or legal obligation.

Contracts, evidence of acceptance, invoices and accounting records: for the period required by applicable law and necessary to establish, exercise or defend legal claims. The period depends on the document type and limitation periods; we do not automatically apply it to all operational trip data.

Unconfirmed newsletter sign-ups: up to 30 days. Active subscriptions: until unsubscription or termination of the service. After 24 months from the last confirmation of interest, we request confirmation again; if none is received within 30 days, sending stops.

Minimal evidence of consent and unsubscription: up to 3 years after the subscription ends, solely for evidential purposes. We keep the minimal record preventing unauthorised resubscription for as long as necessary and review it at least annually.

Ordinary technical logs: up to 30 days. Data about a specific incident may be separated out for the period needed to investigate it and protect legal claims. Backups rotate within 90 days, have restricted access and are not used for ongoing marketing; after a restoration, we reapply previous deletions.

If the purpose ends sooner, we delete data sooner unless another valid basis for continued processing applies. We retain specific data subject to a legal obligation or dispute only to the extent and for the time needed.

Within the scope provided by the GDPR, you may request access to your data and a copy, rectification, erasure or restriction of processing. Where the conditions for data portability are met, you may receive your data in a structured, commonly used format or request its transmission to another controller.

You may object to processing based on legitimate interests on grounds relating to your particular situation. You may object to processing for direct marketing at any time. You may withdraw consent as easily as you gave it.

Send requests to privacy@flashpackers.pl. Exercising your rights is generally free. We may charge a reasonable fee or refuse to act on a request only where the GDPR permits, particularly for manifestly unfounded or excessive requests. No account is required. If we have reasonable doubts about your identity, we ask only for information needed to verify it. We generally respond within one month; we will explain any statutory extension and its reasons.

You may lodge a complaint with a competent supervisory authority, in particular in the country of your habitual residence, place of work or the alleged infringement. In Poland, this is the President of the Personal Data Protection Office (UODO), uodo.gov.pl. You do not have to contact us before lodging a complaint.

Providing data is voluntary. Without data needed to handle an enquiry, consultation or booking, we may be unable to carry out that activity. Refusing marketing consent does not restrict these services. We explain the consequences of not providing health data in relation to the specific requirement or service.

We restrict access to people and entities that need the data for their tasks. Do not send unnecessary data, passwords or full payment card details. Contact us if you suspect disclosure of your data or results link.

We update this policy when our processes, tools, services, contact details or legal obligations change. The current version is available on the website with its effective date. We give notice of changes as required by law, particularly before starting a new use of data where prior information or consent is required.

A policy change does not itself constitute fresh consent or extend earlier consent. We retain previous versions to document the information provided during a particular period.

Translations of content originally prepared in English into Polish or other languages are provided solely to make the website and information about our services easier to use and understand. Providing a translation does not change Flashpackers' identity or country of registration. If versions differ, the English version may help clarify the meaning where it has been provided as the source version. This does not exclude the binding effect of information provided to the user, information obligations or consumer protection under mandatory applicable law. We do not interpret unclear contractual provisions to a consumer's disadvantage solely because of a difference between language versions.

You may send personal data enquiries and requests to us in Polish or English.